⬢ DragonFlyBSD Kernel Audit
DF-3115 / run_guest.sh
← back to finding ↓ download raw
#!/bin/sh
# DF-3115 run: unprivileged directory churn vs unconditional mbnambuf_write
# kprintfs (msdosfs_conv.c:1038/:1048).  Patterns A (non-decreasing id) and
# B (file name length too large).
echo "===== DF-3115 pattern A: unprivileged ls loop vs kernel msgbuf"
vnconfig -c -S 2m /dev/vn0 /root/w/lfn_A.img
mkdir -p /mnt/df3115
mount_msdos -o ro /dev/vn0 /mnt/df3115 || echo MOUNT-FAIL
BEFORE=$(dmesg | grep -c "non-decreasing")
su -m nobody -c 'sh /root/w/loop3115.sh'
AFTER=$(dmesg | grep -c "non-decreasing")
echo "RESULT-A: non-decreasing lines before=$BEFORE after=$AFTER delta=$((AFTER-BEFORE))"
echo "--- last 3 msgbuf lines:"
dmesg | tail -3
umount /mnt/df3115
vnconfig -u vn0

echo "===== DF-3115 pattern B: 130-byte LFN reassembly"
vnconfig -c -S 2m /dev/vn0 /root/w/lfn_B.img
mount_msdos -o ro /dev/vn0 /mnt/df3115 || echo MOUNT-FAIL
B0=$(dmesg | grep -c "file name length")
su -m nobody -c 'sh /root/w/loop3115b.sh'
B1=$(dmesg | grep -c "file name length")
echo "RESULT-B: too-large lines before=$B0 after=$B1 delta=$((B1-B0))"
dmesg | tail -2
umount /mnt/df3115
vnconfig -u vn0
echo "DONE-DF3115"